Granted Patent B2

US 12,375,522 · App. 18/754,090 · Granted Jul 29, 2025

Inventors: Sourabh Satish (Fremont, CA); Oliver Friedrichs (Woodside, CA); Atif Mahadik (Fremont, CA); Govind Salinas (Sunnyvale, CA)

Assignee: Splunk Inc.

H04L63/1441G06F16/285G06F21/554H04L63/0236H04L63/1416H04L63/1425H04L63/1433H04L63/20H04L47/2425

Abstract

Claims (40)

1. A computer-implemented method, comprising:

identifying a security threat within a computing environment comprising a plurality of computing assets;

obtaining state information for the security threat within the computing environment from computing assets of the plurality of computing assets in the computing environment;

determining a current state for the security threat within the computing environment based on the state information;

obtaining enrichment information for the security threat that relates kill-state information to an identity of the security threat, wherein the kill-state information identifies whether the security threat is attempting to migrate to another computing asset of the plurality of computing assets in the computing environment;

determining one or more security actions for the security threat based on the enrichment information and the current state for the security threat; and

translating the one or more security actions into processes for implementing the one or more security actions in a processor of a computing asset of the plurality of computing assets.

2. The computer-implemented method of claim 1 , wherein the security threat comprises an unknown process.

3. The computer-implemented method of claim 2 , wherein obtaining enrichment information for the security threat comprises using an identifier for the unknown process to search for the kill-state information.

4. The computer-implemented method of claim 3 , wherein the identifier for the unknown process comprises a name of the unknown process or a vendor signature associated with the unknown process.

5. The computer-implemented method of claim 2 , wherein the kill-state information comprises timing of operations by the unknown process.

6. The computer-implemented method of claim 1 , wherein the state information for the security threat comprises at least communication activity related to the security threat.

7. The computer-implemented method of claim 6 , wherein the communication activity comprises at least a quantity of connections associated with the security threat and a quantity of exchanged data associated with the security threat.

8. A non-transitory computer-readable storage medium storing instructions that, when executed by one or more processors, cause performance of operations comprising:

identifying a security threat within a computing environment comprising a plurality of computing assets;

obtaining state information for the security threat within the computing environment from computing assets of the plurality of computing assets in the computing environment;

determining a current state for the security threat within the computing environment based on the state information;

obtaining enrichment information for the security threat that relates kill-state information to an identity of the security threat, wherein the kill-state information identifies whether the security threat is attempting to migrate to another computing asset of the plurality of computing assets in the computing environment;

determining one or more security actions for the security threat based on the enrichment information and the current state for the security threat; and

translating the one or more security actions into processes for implementing the one or more security actions in a processor of a computing asset of the plurality of computing assets.

9. The non-transitory computer-readable storage medium of claim 8 , wherein the security threat comprises an unknown process.

10. The non-transitory computer-readable storage medium of claim 9 , wherein obtaining enrichment information for the security threat comprises using an identifier for the unknown process to search for the kill-state information.

11. The non-transitory computer-readable storage medium of claim 10 , wherein the identifier for the unknown process comprises a name of the unknown process or a vendor signature associated with the unknown process.

12. The non-transitory computer-readable storage medium of claim 9 , wherein the kill-state information comprises timing of operations by the unknown process.

13. The non-transitory computer-readable storage medium of claim 8 , wherein the state information for the security threat comprises at least communication activity related to the security threat.

14. The non-transitory computer-readable storage medium of claim 13 , wherein the communication activity comprises at least a quantity of connections associated with the security threat and a quantity of exchanged data associated with the security threat.

15. A computing device, comprising:

one or more processors; and

a non-transitory computer-readable storage medium storing instructions that, when executed by the one or more processors, cause the computing device to:

identify a security threat within a computing environment comprising a plurality of computing assets;

obtain state information for the security threat within the computing environment from computing assets of the plurality of computing assets in the computing environment;

determine a current state for the security threat within the computing environment based on the state information;

obtain enrichment information for the security threat that relates kill-state information to an identity of the security threat, wherein the kill-state information identifies whether the security threat is attempting to migrate to another computing asset of the plurality of computing assets in the computing environment;

determine one or more security actions for the security threat based on the enrichment information and the current state for the security threat; and

translating the one or more security actions into processes for implementing the one or more security actions in a processor of a computing asset of the plurality of computing assets.

16. The computing device of claim 15 , wherein the security threat comprises an unknown process.

17. The computing device of claim 16 , wherein obtaining enrichment information for the security threat comprises using an identifier for the unknown process to search for the kill-state information.

18. The computing device of claim 17 , wherein the identifier for the unknown process comprises a name of the unknown process or a vendor signature associated with the unknown process.

19. The computing device of claim 15 , wherein the state information for the security threat comprises at least communication activity related to the security threat.

20. The computing device of claim 19 , wherein the communication activity comprises at least a quantity of connections associated with the security threat and a quantity of exchanged data associated with the security threat.

Assignments (4)

Continuity (10)

References Cited (286)